312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ237

Procedures and Methodology

Alex, a forensic investigator, is assigned to examine a damaged Android device that may hold critical cybercrime evidence. The device is physically damaged and neither boots nor responds to normal recovery procedures. Alex needs to identify the best method for acquiring data from this damaged device.

Given this situation, Alex must determine the first Android-forensics step required to ensure the data is extracted correctly. Which of the following operations must Alex perform first during the Android forensics process when the evidentiary device is damaged?

  • A Root the device
  • B Perform JTAG forensics
  • C Perform physical acquisition using the ‘dd’ command
  • D Connect the device to a forensic workstation using a USB cable
Explanation

JTAG forensics is the appropriate starting operation for a physically damaged Android device that cannot boot or enter recovery, because it can obtain data through the device’s hardware test-access interface without relying on a working operating system, USB data access, root privileges, or a recovery environment.

Community Discussion

No comments yet. Be the first to start the discussion!